Harden remote control contracts

What's Changed

• Protect certificate regeneration and host paths behind authentication
• Keep only read-only certificate bootstrap routes public
• Fix Bash mt_bootstrap slash-command JSON and remove the retired Operator capability flag